Tech

L'agente ChatGPT sembra scimmiottare il comportamento umano, più che capirlo davvero. E in futuro il web potrebbe assomigliare sempre di più a una città fantasma

AI Coding Horrors is a growing collection of real-world disasters caused by AI-assisted coding tools like sky-high bills, leaked secrets, broken apps,..

AI Engineer at ANZ Bank working on intelligent systems, LLM optimization, and scalable ML platforms.

Impara a usare questo linguaggio e scopri la documentazione dettagliata relativa a classi, funzioni ed elementi.

This is Unsafe If you type thisisunsafe on a Chrome SSL error page, Chrome will bypass the error and load the page for you. Try it yourself here: https://expired.badssl.com/ There’s no textbox to type into, just type thisisunsafe blindly with the page in focus. TIP: To revert the bypass, click the “Not Secure” button in the URL bar and then click “Turn on warnings.” History of the Bypass Code I discovered Chrome SSL error bypass code while debugging SSL issues. I was surprised that something like that existed, and was flooded with of memories of entering ↑ ↑ ↓ ↓ ← → ← → B A into my PS1 as a kid (see Konami Code). Curiosity got the better of me, and, like Tomb Raider searching for ancient artifacts, I started digging into the history of the bypass code in Chromium. Here’s what I found. Danger (2014) The bypass code was originally “danger,” and was added to Chromium in 2014 as part of a larger piece of work to remove duplication between chrome/browser/resources/safe_browsing/ and chrome/browser/resources/ssl/. Safe Browsing HTML/JS is in: chrome/browser/resources/safe_browsing And SSL HTML/JS is in: chrome/browser/resources/ssl But they all essentially use the same code. Merge into a single folder and remove redundancy. Aug 11, 2014 18:03UTC - Chromium Issue #41125304 Why it was added is not clear to me, but presumably it was to allow developers to more easily bypass SSL errors during the raise of SSL-everywhere. https://codereview.chromium.org/480393002/patch/60001/70017 /* * This allows errors to be skippped [sic] by typing "danger" into the page. * @param {string} e The key that was just pressed. */ function handleKeypress(e) { var BYPASS_SEQUENCE = 'danger'; if (BYPASS_SEQUENCE.charCodeAt(keyPressState) == e.keyCode) { keyPressState++; if (keyPressState == BYPASS_SEQUENCE.length) { sendCommand(CMD_PROCEED); keyPressState = 0; } } else { keyPressState = 0; } } Bad Idea (2015) A year later, in 2015, the BYPASS_SEQUENCE was changed to badidea. There are no other changes or comments on the patch, but this change likely reflected concerns around the overuse of the bypass code; concerns that would be echoed in later years. https://codereview.chromium.org/1416273004/patch/1/10001. --- a/components/security_interstitials/core/browser/resources/interstitial_v2.js +++ b/components/security_interstitials/core/browser/resources/interstitial_v2.js @@ -40,7 +40,7 @@ function sendCommand(cmd) { * @param {string} e The key that was just pressed. */ function handleKeypress(e) { - var BYPASS_SEQUENCE = 'danger'; + var BYPASS_SEQUENCE = 'badidea'; if (BYPASS_SEQUENCE.charCodeAt(keyPressState) == e.keyCode) { keyPressState++; if (keyPressState == BYPASS_SEQUENCE.length) { This is not Safe (2018) On Januay 03, 2018, the bypass code was updated again, this time to thisisnotsafe. Unlike before, the code was changed explicitly due to growing concern around the growing popularity of being able to bypass SSL warnings in Chrome. The security interstitial bypass keyword hasn’t changed in two years and awareness of the bypass has been increased in blogs and social media. Rotate the keyword to help prevent misuse. Jan 03, 2018 03:03UTC - Chromium Issue #843085 dGhpc2lzdW5zYWZl (2018 - Present) But then, just a few days later, on January 10, 2018, the bypass code was changed once again: thisisnotesafe was changed to dGhpc2lzdW5zYWZl, in what I can only guess was an attempt at obfuscation. $ echo dGhpc2lzdW5zYWZl | base64 -d thisisunsafe --- a/components/security_interstitials/core/browser/resources/interstitial_large.js +++ b/components/security_interstitials/core/browser/resources/interstitial_large.js @@ -13,7 +13,10 @@ * @param {string} e The key that was just pressed. */ function handleKeypress(e) { - var BYPASS_SEQUENCE = 'thisisnotsafe'; + // HTTPS errors are serious and should not be ignored. For testing purposes, + // other approaches are both safer and have fewer side-effects. + // See https://goo.gl/ZcZixP for more details. + var BYPASS_SEQUENCE = window.atob('dGhpc2lzdW5zYWZl'); if (BYPASS_SEQUENCE.charCodeAt(keyPressState) == e.keyCode) { keyPressState++; if (keyPressState == BYPASS_SEQUENCE.length) { Along with this patch, the Chromium team released a public document titled: Deprecating Powerful Features on Insecure Origins. Though it made no mention of the bypass code, it included instructions for how to bypass SSL errors during development and testing. I presume this is what was meant by the “other approaches are both safer and have fewer side-effects” comment in the code snippet above. You can use chrome://flags/#unsafely-treat-insecure-origin-as-secure to run Chrome, or use the --unsafely-treat-insecure-origin-as-secure="http://example.com" flag (replacing "example.com" with the origin you actually want to test), which will treat that origin as secure for this session. Is this Unsafe? As of the time of writing, the bypass code (along with the skippped typo) has remained unchanged. You can see it in the latest version of Chromium (140.0.7301.1), and it still shows up in blogs and social media posts. /** * This allows errors to be skippped [sic] by typing a secret phrase into the page. * @param {string} e The key that was just pressed. */ function handleKeypress(e) { // HTTPS errors are serious and should not be ignored. For testing purposes, // other approaches are both safer and have fewer side-effects. // See https://goo.gl/ZcZixP for more details. const BYPASS_SEQUENCE = window.atob('dGhpc2lzdW5zYWZl'); if (BYPASS_SEQUENCE.charCodeAt(keyPressState) === e.keyCode) { keyPressState++; if (keyPressState === BYPASS_SEQUENCE.length) { sendCommand(SecurityInterstitialCommandId.CMD_PROCEED); keyPressState = 0; } } else { keyPressState = 0; } } Despite the excavation, I wasn’t able to find the exact reason for the bypass code’s introduction. It seems to have been a convenience for developers, but it has since become a point of concern due to its potential misuse. The change to base64 encoding was likely an attempt to obscure the code from casual users, but it is by no means a secret. SSL-everywhere has been a net-positive for the web, but it’s hard to articulate the risks of broken SSL to everyday users. A popular bypass code might not supply enough friction to prevent misuse, and I’m curious to know what benefits it has over using the --unsafely-treat-insecure-origin-as-secure flag. What do you think?

Have you ever argued with someone who is seriously good at debating? I have. It sucks. You’re constantly thrown off-balance, responding to a point you didn’t expect to. You find yourself defending the weak edges of your argument, while the main thrust gets left behind in the back-and-forth, and you end up losing momentum, confidence, and ultimately, the argument. One of my close friends won international debate competitions for fun while we were at university (he’s now a successful criminal barrister), and he told me that the only trick in the book, once you boil it all down, is to make sure the conversation is framed in your terms. Once that happens, it’s all over bar the shouting.

tiny bitmap fonts

How well do you know JavaScript's Date class?

Here are some of the lessons I learned and how I grew as a leader and manager, as well as a bunch of behind-the-scenes photos.

If you ask the new Grok 4 for opinions on controversial questions, it will sometimes run a search to find out Elon Musk’s stance before providing you with an anwser. …

Framework for running AI locally on mobile devices and wearables. Hardware-aware C/C++ backend with wrappers for Flutter & React Native. Kotlin & Swift coming soon. - cactus-compute/cactus

The GitHub dependency graph maps dependencies in your project, helping you identify risks, prioritize fixes, and keep your code secure.

Generate pairs of colors based on the amount of stimulation you select.

Scrap everything and start again

Bringing the power of MCP to the web

"I will run the tests again. I expect nothing. I am a leaf on the wind." an LLM while coding

OpenAI's browser is said to use AI to rethink how users browse the web, keeping some user interactions inside ChatGPT instead of linking out to websites.

Hugging Face launches Reachy Mini, a $299 open-source desktop robot that democratizes AI development for millions of builders worldwide.

The first frontier.

On StackExchange, someone asks why programmers talk about “calling” a function. Several possible allusions spring to mind: Calling a function is like calling on a friend — we go, we stay a while, we come back. Calling a function is like calling for a servant — a summoning to perform a task. Calling a function is like making a phone call — we ask a question and get an answer from outside ourselves. The true answer seems to be the middle one — “calling” as in “calling up, summoning” — but indirectly, originating in the notion of “calling for” a subroutine out of a library of subroutines in the same way that we’d “call for” a book out of a closed-stack library of books.

Why Astro is perfect for content-driven sites: island architecture, zero JS by default, and blazing-fast performance.

Connect AI agents to GitHub tools and context with OAuth, one-click setup, and automatic updates with GitHub’s hosted server.

The feature is being tested in Meta’s open-to-all AI Studio.

A Lisa-themed Graphical User Interface

The company behind ChatGPT is preaching mission over money as Meta poaches its staff. But a forced vacation and a major departure at a friendly startup tell a different story.